luna - wolfssl/linuxkm/lkcapi

   1/* lkcapi_glue.c -- glue logic to register wolfCrypt implementations with
   2 * the Linux Kernel Cryptosystem
   3 *
   4 * Copyright (C) 2006-2026 wolfSSL Inc.
   5 *
   6 * This file is part of wolfSSL.
   7 *
   8 * wolfSSL is free software; you can redistribute it and/or modify
   9 * it under the terms of the GNU General Public License as published by
  10 * the Free Software Foundation; either version 3 of the License, or
  11 * (at your option) any later version.
  12 *
  13 * wolfSSL is distributed in the hope that it will be useful,
  14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 * GNU General Public License for more details.
  17 *
  18 * You should have received a copy of the GNU General Public License
  19 * along with this program; if not, write to the Free Software
  20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  21 */
  22
  23/* included by linuxkm/module_hooks.c */
  24#ifndef WC_SKIP_INCLUDED_C_FILES
  25
  26#ifndef LINUXKM_LKCAPI_REGISTER
  27    #error lkcapi_glue.c included in non-LINUXKM_LKCAPI_REGISTER project.
  28#endif
  29
  30#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 0)
  31    #error LINUXKM_LKCAPI_REGISTER is supported only on Linux kernel versions >= 5.4.0.
  32#endif
  33
  34#if defined(CONFIG_CRYPTO_MANAGER) && \
  35    !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
  36    /* kernel crypto self-test includes test setups that have different expected
  37     * results FIPS vs non-FIPS, and the required kernel exported symbol
  38     * "fips_enabled" is only available in CONFIG_CRYPTO_FIPS kernels (otherwise
  39     * it's a macro hardcoding it to literal 0).
  40     */
  41    #if defined(CONFIG_CRYPTO_FIPS) != defined(HAVE_FIPS)
  42        #error CONFIG_CRYPTO_MANAGER requires that CONFIG_CRYPTO_FIPS match HAVE_FIPS.
  43    #endif
  44    #include <linux/fips.h>
  45#endif
  46
  47/* need misc.c for ForceZero(). */
  48#ifdef NO_INLINE
  49    #include <wolfssl/wolfcrypt/misc.h>
  50#else
  51    #define WOLFSSL_MISC_INCLUDED
  52    #include <wolfcrypt/src/misc.c>
  53#endif
  54
  55#ifndef WOLFSSL_LINUXKM_LKCAPI_PRIORITY
  56    /* Larger number means higher priority.  The highest in-tree priority is
  57     * 4001, in the Cavium driver.
  58     *
  59     * Note bene, when the kernel dynamically constructs compound algorithms, it
  60     * computes their priorities by multiplying the priority of the base
  61     * algorithm by up to 10, and/or adding to it the priority of a second base
  62     * algorithm, or a constant up to 200, so it's not safe to use a value near
  63     * INT_MAX here.
  64     */
  65    #define WOLFSSL_LINUXKM_LKCAPI_PRIORITY 100000
  66#endif
  67
  68#if defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS) || \
  69    defined(CONFIG_CRYPTO_SELFTESTS_FULL)
  70    static int disable_setkey_warnings = 0;
  71#else
  72    #define disable_setkey_warnings 0
  73#endif
  74
  75#ifdef HAVE_FIPS
  76    #ifndef HAVE_FIPS_VERSION
  77        #define WOLFKM_DRIVER_FIPS "-fips-140"
  78    #elif HAVE_FIPS_VERSION >= 5
  79        #define WOLFKM_DRIVER_FIPS "-fips-140-3"
  80    #elif HAVE_FIPS_VERSION == 2
  81        #define WOLFKM_DRIVER_FIPS "-fips-140-2"
  82    #else
  83        #define WOLFKM_DRIVER_FIPS "-fips-140"
  84    #endif
  85#else
  86    #define WOLFKM_DRIVER_FIPS ""
  87#endif
  88
  89#define WOLFKM_DRIVER_SUFFIX_BASE "-wolfcrypt" WOLFKM_DRIVER_FIPS
  90
  91#define WOLFKM_INSTALL_NOTICE(alg)                                      \
  92    pr_info("%s self-test OK -- "                                       \
  93            "registered for %s with priority %d.\n",                    \
  94            (alg).base.cra_driver_name,                                 \
  95            (alg).base.cra_name,                                        \
  96            (alg).base.cra_priority);                                   \
  97
  98#if defined(WOLFSSL_AESNI) || defined(USE_INTEL_SPEEDUP) || \
  99    defined(USE_INTEL_SPEEDUP_FOR_AES)
 100    #define LKCAPI_HAVE_ARCH_ACCEL
 101#endif
 102
 103#if defined(LKCAPI_HAVE_ARCH_ACCEL) &&                   \
 104    (!defined(WC_C_DYNAMIC_FALLBACK) ||                  \
 105     (defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0))) && \
 106    !defined(WC_LINUXKM_C_FALLBACK_IN_SHIMS)
 107    #define WC_LINUXKM_C_FALLBACK_IN_SHIMS
 108#elif !defined(LKCAPI_HAVE_ARCH_ACCEL)
 109    #undef WC_LINUXKM_C_FALLBACK_IN_SHIMS
 110#endif
 111
 112#if defined(WC_LINUXKM_C_FALLBACK_IN_SHIMS) && !defined(CAN_SAVE_VECTOR_REGISTERS)
 113    #error WC_LINUXKM_C_FALLBACK_IN_SHIMS is defined but CAN_SAVE_VECTOR_REGISTERS is missing.
 114#endif
 115
 116WC_MAYBE_UNUSED static int check_skcipher_driver_masking(struct crypto_skcipher *tfm, const char *alg_name, const char *expected_driver_name) {
 117#ifdef LINUXKM_LKCAPI_PRIORITY_ALLOW_MASKING
 118    (void)tfm; (void)alg_name; (void)expected_driver_name;
 119    return 0;
 120#else
 121    const char *actual_driver_name;
 122    int ret;
 123    int alloced_tfm = 0;
 124
 125    if (! tfm) {
 126        alloced_tfm = 1;
 127        tfm = crypto_alloc_skcipher(alg_name, 0, 0);
 128    }
 129    if (IS_ERR(tfm)) {
 130        pr_err("error: allocating skcipher algorithm %s failed: %ld\n",
 131               alg_name, PTR_ERR(tfm));
 132        return -EINVAL;
 133    }
 134    actual_driver_name = crypto_tfm_alg_driver_name(crypto_skcipher_tfm(tfm));
 135    if (strcmp(actual_driver_name, expected_driver_name)) {
 136        pr_err("error: unexpected implementation for %s: %s (expected %s)\n",
 137               alg_name, actual_driver_name, expected_driver_name);
 138        ret = -ENOENT;
 139    } else
 140        ret = 0;
 141
 142    if (alloced_tfm)
 143        crypto_free_skcipher(tfm);
 144
 145    return ret;
 146#endif
 147}
 148
 149WC_MAYBE_UNUSED static int check_aead_driver_masking(struct crypto_aead *tfm, const char *alg_name, const char *expected_driver_name) {
 150#ifdef LINUXKM_LKCAPI_PRIORITY_ALLOW_MASKING
 151    (void)tfm; (void)alg_name; (void)expected_driver_name;
 152    return 0;
 153#else
 154    const char *actual_driver_name;
 155    int ret;
 156    int alloced_tfm = 0;
 157
 158    if (! tfm) {
 159        alloced_tfm = 1;
 160        tfm = crypto_alloc_aead(alg_name, 0, 0);
 161    }
 162    if (IS_ERR(tfm)) {
 163        pr_err("error: allocating AEAD algorithm %s failed: %ld\n",
 164               alg_name, PTR_ERR(tfm));
 165        return -EINVAL;
 166    }
 167    actual_driver_name = crypto_tfm_alg_driver_name(crypto_aead_tfm(tfm));
 168    if (strcmp(actual_driver_name, expected_driver_name)) {
 169        pr_err("error: unexpected implementation for %s: %s (expected %s)\n",
 170               alg_name, actual_driver_name, expected_driver_name);
 171        ret = -ENOENT;
 172    } else
 173        ret = 0;
 174
 175    if (alloced_tfm)
 176        crypto_free_aead(tfm);
 177
 178    return ret;
 179#endif
 180}
 181
 182WC_MAYBE_UNUSED static int check_shash_driver_masking(struct crypto_shash *tfm, const char *alg_name, const char *expected_driver_name) {
 183#ifdef LINUXKM_LKCAPI_PRIORITY_ALLOW_MASKING
 184    (void)tfm; (void)alg_name; (void)expected_driver_name;
 185    return 0;
 186#else
 187    const char *actual_driver_name;
 188    int ret;
 189    int alloced_tfm = 0;
 190
 191    if (! tfm) {
 192        alloced_tfm = 1;
 193        tfm = crypto_alloc_shash(alg_name, 0, 0);
 194    }
 195    if (IS_ERR(tfm)) {
 196        pr_err("error: allocating shash algorithm %s failed: %ld\n",
 197               alg_name, PTR_ERR(tfm));
 198        return -EINVAL;
 199    }
 200    actual_driver_name = crypto_tfm_alg_driver_name(crypto_shash_tfm(tfm));
 201    if (strcmp(actual_driver_name, expected_driver_name)) {
 202        pr_err("error: unexpected implementation for %s: %s (expected %s)\n",
 203               alg_name, actual_driver_name, expected_driver_name);
 204        ret = -ENOENT;
 205    } else
 206        ret = 0;
 207
 208    if (alloced_tfm)
 209        crypto_free_shash(tfm);
 210
 211    return ret;
 212#endif
 213}
 214
 215static wolfSSL_Atomic_Int linuxkm_lkcapi_registering_now = WOLFSSL_ATOMIC_INITIALIZER(0);
 216
 217#include "lkcapi_aes_glue.c"
 218#include "lkcapi_sha_glue.c" /* must be included before the PK glue, to make the
 219                              * crypto_default_rng usable therein when
 220                              * LINUXKM_LKCAPI_REGISTER_HASH_DRBG_DEFAULT.
 221                              */
 222#include "lkcapi_ecdsa_glue.c"
 223#include "lkcapi_ecdh_glue.c"
 224#include "lkcapi_rsa_glue.c"
 225#include "lkcapi_dh_glue.c"
 226
 227static int linuxkm_lkcapi_register(void);
 228static int linuxkm_lkcapi_unregister(void);
 229
 230#if defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_MANAGER) && \
 231    !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
 232static int enabled_fips = 0;
 233#endif
 234
 235static ssize_t install_algs_handler(struct kobject *kobj, struct kobj_attribute *attr,
 236                              const char *buf, size_t count)
 237{
 238    int arg;
 239    int ret;
 240
 241    (void)kobj;
 242    (void)attr;
 243
 244    if (kstrtoint(buf, 10, &arg) || arg != 1)
 245        return -EINVAL;
 246
 247    pr_info("wolfCrypt: Installing algorithms\n");
 248
 249    ret = linuxkm_lkcapi_register();
 250    if (ret != 0)
 251        return ret;
 252
 253    return count;
 254}
 255
 256static ssize_t deinstall_algs_handler(struct kobject *kobj, struct kobj_attribute *attr,
 257                              const char *buf, size_t count)
 258{
 259    int arg;
 260    int ret;
 261
 262    (void)kobj;
 263    (void)attr;
 264
 265    if (kstrtoint(buf, 10, &arg) || arg != 1)
 266        return -EINVAL;
 267
 268    pr_info("wolfCrypt: Deinstalling algorithms\n");
 269
 270    ret = linuxkm_lkcapi_unregister();
 271    if (ret != 0)
 272        return ret;
 273
 274#if defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_MANAGER) && \
 275    !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
 276    if (enabled_fips) {
 277        pr_info("wolfCrypt: restoring fips_enabled to off.\n");
 278        enabled_fips = fips_enabled = 0;
 279    }
 280#endif
 281
 282    return count;
 283}
 284
 285/* create control channels at /sys/module/libwolfssl/{install_algs,deinstall_algs} */
 286
 287static struct kobj_attribute install_algs_attr = __ATTR(install_algs, 0220, NULL, install_algs_handler);
 288static struct kobj_attribute deinstall_algs_attr = __ATTR(deinstall_algs, 0220, NULL, deinstall_algs_handler);
 289
 290static int installed_sysfs_LKCAPI_files = 0;
 291
 292static int linuxkm_lkcapi_sysfs_install(void) {
 293    int ret;
 294    if (! installed_sysfs_LKCAPI_files) {
 295        ret = linuxkm_lkcapi_sysfs_install_node(&install_algs_attr, NULL);
 296        if (ret)
 297            return ret;
 298        ret = linuxkm_lkcapi_sysfs_install_node(&deinstall_algs_attr, NULL);
 299        if (ret)
 300            return ret;
 301        installed_sysfs_LKCAPI_files = 1;
 302    }
 303    return 0;
 304}
 305
 306static int linuxkm_lkcapi_sysfs_deinstall(void) {
 307    if (installed_sysfs_LKCAPI_files) {
 308        int ret = linuxkm_lkcapi_sysfs_deinstall_node(&install_algs_attr, NULL);
 309        if (ret)
 310            return ret;
 311        ret = linuxkm_lkcapi_sysfs_deinstall_node(&deinstall_algs_attr, NULL);
 312        if (ret)
 313            return ret;
 314        installed_sysfs_LKCAPI_files = 0;
 315    }
 316    return 0;
 317}
 318
 319static int linuxkm_lkcapi_registered = 0;
 320static int linuxkm_lkcapi_n_registered = 0;
 321
 322static int linuxkm_lkcapi_register(void)
 323{
 324    int ret = -1;
 325    int seen_err = 0;
 326    int current_linuxkm_lkcapi_registering_now = 0;
 327
 328    if (! wolfSSL_Atomic_Int_CompareExchange(
 329            &linuxkm_lkcapi_registering_now,
 330            &current_linuxkm_lkcapi_registering_now,
 331            1))
 332    {
 333        return -EDEADLK;
 334    }
 335
 336    if (WC_SIG_IGNORE_BEGIN() < 0) {
 337        ret = -ECANCELED;
 338        pr_err("ERROR: WC_SIG_IGNORE_BEGIN() failed.\n");
 339        goto out_without_sig_ignored;
 340    }
 341
 342    ret = linuxkm_lkcapi_sysfs_install();
 343    if (ret)
 344        goto out;
 345
 346#if defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS) || \
 347    defined(CONFIG_CRYPTO_SELFTESTS_FULL)
 348    /* temporarily disable warnings around setkey failures, which are expected
 349     * from the crypto fuzzer in FIPS configs, and potentially in others.
 350     * unexpected setkey failures are fatal errors returned by the fuzzer.
 351     */
 352    disable_setkey_warnings = 1;
 353#endif
 354#if !defined(LINUXKM_DONT_FORCE_FIPS_ENABLED) && \
 355    defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_MANAGER) && \
 356    !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
 357    if (! fips_enabled) {
 358        /* assert system-wide FIPS status, to disable FIPS-forbidden
 359         * test vectors and fuzzing from the CRYPTO_MANAGER.
 360         */
 361        pr_info("wolfCrypt: changing fips_enabled from 0 to 1 for FIPS module.\n");
 362        enabled_fips = fips_enabled = 1;
 363    }
 364#endif
 365
 366#define REGISTER_ALG(alg, alg_class, tester) do {                            \
 367        if (! alg ## _loaded) {                                              \
 368            ret =  (crypto_register_ ## alg_class)(&(alg));                  \
 369            if (ret) {                                                       \
 370                seen_err = ret;                                              \
 371                pr_err("ERROR: crypto_register_" #alg_class " for %s failed "\
 372                       "with return code %d.\n",                             \
 373                       (alg).base.cra_driver_name, ret);                     \
 374            } else {                                                         \
 375                ret = (tester());                                            \
 376                if (ret) {                                                   \
 377                    seen_err = -EINVAL;                                      \
 378                    pr_err("ERROR: wolfCrypt self-test for %s failed "       \
 379                           "with return code %d.\n",                         \
 380                           (alg).base.cra_driver_name, ret);                 \
 381                    (crypto_unregister_ ## alg_class)(&(alg));               \
 382                    if (! ((alg).base.cra_flags & CRYPTO_ALG_DEAD)) {        \
 383                        pr_err("ERROR: alg %s not _DEAD "                    \
 384                               "after crypto_unregister_%s -- "              \
 385                               "marking as loaded despite test failure.\n",  \
 386                               (alg).base.cra_driver_name,                   \
 387                               #alg_class);                                  \
 388                        alg ## _loaded = 1;                                  \
 389                        ++linuxkm_lkcapi_n_registered;                       \
 390                    }                                                        \
 391                } else {                                                     \
 392                    alg ## _loaded = 1;                                      \
 393                    ++linuxkm_lkcapi_n_registered;                           \
 394                    WOLFKM_INSTALL_NOTICE(alg)                               \
 395                }                                                            \
 396            }                                                                \
 397        }                                                                    \
 398    } while (0)
 399
 400#if defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_MANAGER) && \
 401    !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
 402/* Same as above, but allow for option to skip problematic algs that are
 403 * not consistently labeled fips_allowed in crypto/testmgr.c, and hence
 404 * may be rejected by the kernel at runtime if is_fips is true. */
 405#define REGISTER_ALG_OPTIONAL(alg, alg_class, tester) do {\
 406        if (! alg ## _loaded) {                                              \
 407            ret =  (crypto_register_ ## alg_class)(&(alg));                  \
 408            if (ret) {                                                       \
 409                if (fips_enabled && (ret == WC_NO_ERR_TRACE(NOT_COMPILED_IN))) { \
 410                    pr_info("wolfCrypt: skipping FIPS-incompatible alg %s.\n", \
 411                            (alg).base.cra_driver_name);                     \
 412                }                                                            \
 413                else {                                                       \
 414                    seen_err = ret;                                          \
 415                    pr_err("ERROR: crypto_register_" #alg_class              \
 416                           " for %s failed "                                 \
 417                           "with return code %d.\n",                         \
 418                           (alg).base.cra_driver_name, ret);                 \
 419                }                                                            \
 420            } else {                                                         \
 421                ret = (tester());                                            \
 422                if (ret) {                                                   \
 423                    if (fips_enabled && (ret == WC_NO_ERR_TRACE(NOT_COMPILED_IN))) { \
 424                        pr_info("wolfCrypt: skipping FIPS-incompatible alg %s.\n", \
 425                                (alg).base.cra_driver_name);                 \
 426                    }                                                        \
 427                    else {                                                   \
 428                        seen_err = -EINVAL;                                  \
 429                        pr_err("ERROR: wolfCrypt self-test for %s failed "   \
 430                               "with return code %d.\n",                     \
 431                               (alg).base.cra_driver_name, ret);             \
 432                    }                                                        \
 433                    (crypto_unregister_ ## alg_class)(&(alg));               \
 434                    if (! ((alg).base.cra_flags & CRYPTO_ALG_DEAD)) {        \
 435                        pr_err("ERROR: alg %s not _DEAD "                    \
 436                               "after crypto_unregister_%s -- "              \
 437                               "marking as loaded despite test failure.\n",  \
 438                               (alg).base.cra_driver_name,                   \
 439                               #alg_class);                                  \
 440                        alg ## _loaded = 1;                                  \
 441                        ++linuxkm_lkcapi_n_registered;                       \
 442                    }                                                        \
 443                } else {                                                     \
 444                    alg ## _loaded = 1;                                      \
 445                    ++linuxkm_lkcapi_n_registered;                           \
 446                    WOLFKM_INSTALL_NOTICE(alg)                               \
 447                }                                                            \
 448            }                                                                \
 449        }                                                                    \
 450    } while (0)
 451#endif /* HAVE_FIPS && CONFIG_CRYPTO_MANAGER && etc.. */
 452
 453    /* We always register the derivative/composite algs first, to assure that
 454     * the kernel doesn't synthesize them dynamically from our primitives.
 455     */
 456
 457#ifdef LINUXKM_LKCAPI_REGISTER_AESGCM_RFC4106
 458    REGISTER_ALG(gcmAesAead_rfc4106, aead, linuxkm_test_aesgcm_rfc4106);
 459#endif
 460#ifdef LINUXKM_LKCAPI_REGISTER_AESGCM
 461    REGISTER_ALG(gcmAesAead, aead, linuxkm_test_aesgcm);
 462#endif
 463#ifdef LINUXKM_LKCAPI_REGISTER_AESCCM_RFC4309
 464    REGISTER_ALG(ccmAesAead_rfc4309, aead, linuxkm_test_aesccm_rfc4309);
 465#endif
 466#ifdef LINUXKM_LKCAPI_REGISTER_AESCCM
 467    REGISTER_ALG(ccmAesAead, aead, linuxkm_test_aesccm);
 468#endif
 469#ifdef LINUXKM_LKCAPI_REGISTER_AESXTS
 470    REGISTER_ALG(xtsAesAlg, skcipher, linuxkm_test_aesxts);
 471#endif
 472#ifdef LINUXKM_LKCAPI_REGISTER_AESCFB
 473    REGISTER_ALG(cfbAesAlg, skcipher, linuxkm_test_aescfb);
 474#endif
 475#ifdef LINUXKM_LKCAPI_REGISTER_AESOFB
 476    REGISTER_ALG(ofbAesAlg, skcipher, linuxkm_test_aesofb);
 477#endif
 478#ifdef LINUXKM_LKCAPI_REGISTER_AESCBC
 479    REGISTER_ALG(cbcAesAlg, skcipher, linuxkm_test_aescbc);
 480#endif
 481#ifdef LINUXKM_LKCAPI_REGISTER_AESCTR
 482    REGISTER_ALG(ctrAesAlg, skcipher, linuxkm_test_aesctr);
 483#endif
 484#ifdef LINUXKM_LKCAPI_REGISTER_AESECB
 485    REGISTER_ALG(ecbAesAlg, skcipher, linuxkm_test_aesecb);
 486#endif
 487
 488/* SHA algs must be registered before PK algs, to make the crypto_default_rng
 489 * available beforehand when LINUXKM_LKCAPI_REGISTER_HASH_DRBG_DEFAULT.
 490 */
 491#ifdef LINUXKM_LKCAPI_REGISTER_SHA1_HMAC
 492    REGISTER_ALG(sha1_hmac_alg, shash, linuxkm_test_sha1_hmac);
 493#endif
 494#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_224_HMAC
 495    REGISTER_ALG(sha2_224_hmac_alg, shash, linuxkm_test_sha2_224_hmac);
 496#endif
 497#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_256_HMAC
 498    REGISTER_ALG(sha2_256_hmac_alg, shash, linuxkm_test_sha2_256_hmac);
 499#endif
 500#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_384_HMAC
 501    REGISTER_ALG(sha2_384_hmac_alg, shash, linuxkm_test_sha2_384_hmac);
 502#endif
 503#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_512_HMAC
 504    REGISTER_ALG(sha2_512_hmac_alg, shash, linuxkm_test_sha2_512_hmac);
 505#endif
 506#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_224_HMAC
 507    REGISTER_ALG(sha3_224_hmac_alg, shash, linuxkm_test_sha3_224_hmac);
 508#endif
 509#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_256_HMAC
 510    REGISTER_ALG(sha3_256_hmac_alg, shash, linuxkm_test_sha3_256_hmac);
 511#endif
 512#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_384_HMAC
 513    REGISTER_ALG(sha3_384_hmac_alg, shash, linuxkm_test_sha3_384_hmac);
 514#endif
 515#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_512_HMAC
 516    REGISTER_ALG(sha3_512_hmac_alg, shash, linuxkm_test_sha3_512_hmac);
 517#endif
 518
 519#ifdef LINUXKM_LKCAPI_REGISTER_SHA1
 520    REGISTER_ALG(sha1_alg, shash, linuxkm_test_sha1);
 521#endif
 522#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_224
 523    REGISTER_ALG(sha2_224_alg, shash, linuxkm_test_sha2_224);
 524#endif
 525#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_256
 526    REGISTER_ALG(sha2_256_alg, shash, linuxkm_test_sha2_256);
 527#endif
 528#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_384
 529    REGISTER_ALG(sha2_384_alg, shash, linuxkm_test_sha2_384);
 530#endif
 531#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_512
 532    REGISTER_ALG(sha2_512_alg, shash, linuxkm_test_sha2_512);
 533#endif
 534#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_224
 535    REGISTER_ALG(sha3_224_alg, shash, linuxkm_test_sha3_224);
 536#endif
 537#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_256
 538    REGISTER_ALG(sha3_256_alg, shash, linuxkm_test_sha3_256);
 539#endif
 540#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_384
 541    REGISTER_ALG(sha3_384_alg, shash, linuxkm_test_sha3_384);
 542#endif
 543#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_512
 544    REGISTER_ALG(sha3_512_alg, shash, linuxkm_test_sha3_512);
 545#endif
 546
 547#ifdef LINUXKM_LKCAPI_REGISTER_HASH_DRBG
 548    /* special installation handler for wc_linuxkm_drbg, to conditionally
 549     * install it as the system-wide default rng.
 550     */
 551    if (! wc_linuxkm_drbg_loaded) {
 552        ret = wc_linuxkm_drbg_startup();
 553        if (ret == 0)
 554            ++linuxkm_lkcapi_n_registered;
 555        else
 556            seen_err = ret;
 557    }
 558#endif
 559
 560#ifdef LINUXKM_LKCAPI_REGISTER_ECDSA
 561    #if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)) &&    \
 562        defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && \
 563        defined(CONFIG_CRYPTO_MANAGER) &&                    \
 564        !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
 565        /*
 566         * ecdsa was not recognized as fips_allowed before linux v6.3
 567         * in kernel crypto/testmgr.c.
 568         */
 569        #if defined(LINUXKM_ECC192)
 570        REGISTER_ALG_OPTIONAL(ecdsa_nist_p192, akcipher,
 571                              linuxkm_test_ecdsa_nist_p192);
 572        #endif /* LINUXKM_ECC192 */
 573
 574        REGISTER_ALG_OPTIONAL(ecdsa_nist_p256, akcipher,
 575                              linuxkm_test_ecdsa_nist_p256);
 576
 577        REGISTER_ALG_OPTIONAL(ecdsa_nist_p384, akcipher,
 578                              linuxkm_test_ecdsa_nist_p384);
 579
 580        #if defined(HAVE_ECC521)
 581        REGISTER_ALG_OPTIONAL(ecdsa_nist_p521, akcipher,
 582                              linuxkm_test_ecdsa_nist_p521);
 583        #endif /* HAVE_ECC521 */
 584    #else
 585        #if defined(LINUXKM_ECC192)
 586        REGISTER_ALG(ecdsa_nist_p192, akcipher,
 587                     linuxkm_test_ecdsa_nist_p192);
 588        #endif /* LINUXKM_ECC192 */
 589
 590        REGISTER_ALG(ecdsa_nist_p256, akcipher,
 591                     linuxkm_test_ecdsa_nist_p256);
 592
 593        REGISTER_ALG(ecdsa_nist_p384, akcipher,
 594                     linuxkm_test_ecdsa_nist_p384);
 595
 596        #if defined(HAVE_ECC521)
 597        REGISTER_ALG(ecdsa_nist_p521, akcipher,
 598                     linuxkm_test_ecdsa_nist_p521);
 599        #endif /* HAVE_ECC521 */
 600    #endif /* if linux < 6.3 && HAVE_FIPS && etc.. */
 601
 602    #if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)) &&    \
 603        defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && \
 604        defined(CONFIG_CRYPTO_MANAGER) &&                    \
 605        !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
 606    #endif
 607
 608#endif /* LINUXKM_LKCAPI_REGISTER_ECDSA */
 609
 610#ifdef LINUXKM_LKCAPI_REGISTER_ECDH
 611
 612   /* In kernels before 5.13.0, ecdh-nist-p256 was not recognized as
 613    * fips_allowed, and ecdh-nist-p384 was completely
 614    * missing before 5.14 and not fips_allowed before 5.15.
 615    *
 616    * RedHat also recently patched their crypto manager to mark ECDH
 617    * !fips_allowed due the vagaries of their own certificate.  (See 5074fb61f6,
 618    * 2025-Mar-13.)
 619    *
 620    * Given the above, and given we're not actually relying on the crypto
 621    * manager for FIPS self tests, and given the FIPS ECDH implementation passes
 622    * the non-FIPS ECDH crypto manager tests, the pragmatic solution we settle
 623    * on here is for ECDH loading to be optional when fips and fips tests are
 624    * enabled. Failures because of !fips_allowed are skipped over.
 625    */
 626    #if defined(HAVE_FIPS) && defined(CONFIG_CRYPTO_FIPS) && \
 627        defined(CONFIG_CRYPTO_MANAGER) &&             \
 628        !defined(CONFIG_CRYPTO_MANAGER_DISABLE_TESTS)
 629        #if defined(LINUXKM_ECC192)
 630        REGISTER_ALG_OPTIONAL(ecdh_nist_p192, kpp, linuxkm_test_ecdh_nist_p192);
 631        #endif /* LINUXKM_ECC192 */
 632        REGISTER_ALG_OPTIONAL(ecdh_nist_p256, kpp, linuxkm_test_ecdh_nist_p256);
 633        REGISTER_ALG_OPTIONAL(ecdh_nist_p384, kpp, linuxkm_test_ecdh_nist_p384);
 634    #else
 635        #if defined(LINUXKM_ECC192)
 636        REGISTER_ALG(ecdh_nist_p192, kpp, linuxkm_test_ecdh_nist_p192);
 637        #endif /* LINUXKM_ECC192 */
 638        REGISTER_ALG(ecdh_nist_p256, kpp, linuxkm_test_ecdh_nist_p256);
 639        REGISTER_ALG(ecdh_nist_p384, kpp, linuxkm_test_ecdh_nist_p384);
 640    #endif /* CONFIG_CRYPTO_FIPS && etc.. */
 641#endif /* LINUXKM_LKCAPI_REGISTER_ECDH */
 642
 643#ifdef LINUXKM_LKCAPI_REGISTER_RSA
 644    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
 645        /* linux kernel < 6.13 consists of:
 646         *   akcipher: "pkcs1pad(<rsa>, <hash>)" */
 647        #ifdef WOLFSSL_SHA224
 648        REGISTER_ALG(pkcs1_sha224, akcipher, linuxkm_test_pkcs1_sha224);
 649        #endif /* WOLFSSL_SHA224 */
 650        #ifndef NO_SHA256
 651        REGISTER_ALG(pkcs1_sha256, akcipher, linuxkm_test_pkcs1_sha256);
 652        #endif /* !NO_SHA256 */
 653        #ifdef WOLFSSL_SHA384
 654        REGISTER_ALG(pkcs1_sha384, akcipher, linuxkm_test_pkcs1_sha384);
 655        #endif /* WOLFSSL_SHA384 */
 656        #ifdef WOLFSSL_SHA512
 657        REGISTER_ALG(pkcs1_sha512, akcipher, linuxkm_test_pkcs1_sha512);
 658        #endif /* WOLFSSL_SHA512 */
 659        #ifdef WOLFSSL_SHA3
 660        REGISTER_ALG(pkcs1_sha3_256, akcipher, linuxkm_test_pkcs1_sha3_256);
 661        REGISTER_ALG(pkcs1_sha3_384, akcipher, linuxkm_test_pkcs1_sha3_384);
 662        REGISTER_ALG(pkcs1_sha3_512, akcipher, linuxkm_test_pkcs1_sha3_512);
 663        #endif /* WOLFSSL_SHA3 */
 664    #else
 665        /* linux kernel >= 6.13 consists of:
 666         *   akcipher: "pkcs1pad(<rsa>)"
 667         *   sig:      "pkcs1(<rsa>, <hash>)" */
 668        #ifdef WOLFSSL_SHA224
 669        REGISTER_ALG(pkcs1_sha224, sig, linuxkm_test_pkcs1_sha224);
 670        #endif /* WOLFSSL_SHA224 */
 671        #ifndef NO_SHA256
 672        REGISTER_ALG(pkcs1_sha256, sig, linuxkm_test_pkcs1_sha256);
 673        #endif /* !NO_SHA256 */
 674        #ifdef WOLFSSL_SHA384
 675        REGISTER_ALG(pkcs1_sha384, sig, linuxkm_test_pkcs1_sha384);
 676        #endif /* WOLFSSL_SHA384 */
 677        #ifdef WOLFSSL_SHA512
 678        REGISTER_ALG(pkcs1_sha512, sig, linuxkm_test_pkcs1_sha512);
 679        #endif /* WOLFSSL_SHA512 */
 680        #ifdef WOLFSSL_SHA3
 681        REGISTER_ALG(pkcs1_sha3_256, sig, linuxkm_test_pkcs1_sha3_256);
 682        REGISTER_ALG(pkcs1_sha3_384, sig, linuxkm_test_pkcs1_sha3_384);
 683        REGISTER_ALG(pkcs1_sha3_512, sig, linuxkm_test_pkcs1_sha3_512);
 684        #endif /* WOLFSSL_SHA3 */
 685
 686        REGISTER_ALG(pkcs1pad, akcipher, linuxkm_test_pkcs1pad);
 687    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
 688
 689    #if defined(LINUXKM_DIRECT_RSA)
 690    /* Note, direct RSA must be registered after all PKCS1 algs have been
 691     * registered, to assure that the kernel doesn't dynamically synthesize any
 692     * PKCS1 implementations using the raw primitive.
 693     */
 694    REGISTER_ALG(direct_rsa, akcipher, linuxkm_test_rsa);
 695    #endif /* LINUXKM_DIRECT_RSA */
 696#endif
 697
 698#ifdef LINUXKM_LKCAPI_REGISTER_DH
 699    #ifdef HAVE_FFDHE_2048
 700    REGISTER_ALG(ffdhe2048, kpp, linuxkm_test_ffdhe2048);
 701    #endif /* HAVE_FFDHE_2048 */
 702
 703    #ifdef HAVE_FFDHE_3072
 704    REGISTER_ALG(ffdhe3072, kpp, linuxkm_test_ffdhe3072);
 705    #endif /* HAVE_FFDHE_3072 */
 706
 707    #ifdef HAVE_FFDHE_4096
 708    REGISTER_ALG(ffdhe4096, kpp, linuxkm_test_ffdhe4096);
 709    #endif /* HAVE_FFDHE_4096 */
 710
 711    #ifdef HAVE_FFDHE_6144
 712    REGISTER_ALG(ffdhe6144, kpp, linuxkm_test_ffdhe6144);
 713    #endif /* HAVE_FFDHE_6144 */
 714
 715    #ifdef HAVE_FFDHE_8192
 716    REGISTER_ALG(ffdhe8192, kpp, linuxkm_test_ffdhe8192);
 717    #endif /* HAVE_FFDHE_8192 */
 718
 719    #ifdef LINUXKM_DH
 720    REGISTER_ALG(dh, kpp, linuxkm_test_dh);
 721    #endif /* LINUXKM_DH */
 722#endif /* LINUXKM_LKCAPI_REGISTER_DH */
 723
 724#undef REGISTER_ALG
 725#undef REGISTER_ALG_OPTIONAL
 726
 727#if defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS) || \
 728    defined(CONFIG_CRYPTO_SELFTESTS_FULL)
 729    disable_setkey_warnings = 0;
 730#endif
 731
 732    pr_info("wolfCrypt: %d algorithm%s registered.\n", linuxkm_lkcapi_n_registered,
 733            linuxkm_lkcapi_n_registered == 1 ? "" : "s");
 734
 735    if (ret == -1) {
 736        /* no installations occurred */
 737        if (linuxkm_lkcapi_registered) {
 738            ret = -EEXIST;
 739            goto out;
 740        }
 741        else {
 742            linuxkm_lkcapi_registered = 1;
 743            ret = 0;
 744            goto out;
 745        }
 746    }
 747    else {
 748        /* flag that linuxkm_lkcapi_register has been called, even if an error
 749         * occurred.
 750         */
 751        linuxkm_lkcapi_registered = 1;
 752        ret = seen_err;
 753        goto out;
 754    }
 755
 756out:
 757
 758    (void)WC_SIG_IGNORE_END();
 759
 760out_without_sig_ignored:
 761
 762    WOLFSSL_ATOMIC_STORE(linuxkm_lkcapi_registering_now, 0);
 763
 764    return ret;
 765}
 766
 767static int linuxkm_lkcapi_unregister(void)
 768{
 769    int seen_err = 0;
 770    int n_deregistered = 0;
 771    int ret;
 772    int current_linuxkm_lkcapi_registering_now = 0;
 773
 774    if (! wolfSSL_Atomic_Int_CompareExchange(
 775            &linuxkm_lkcapi_registering_now,
 776            &current_linuxkm_lkcapi_registering_now,
 777            1))
 778    {
 779        return -EDEADLK;
 780    }
 781
 782    if (WC_SIG_IGNORE_BEGIN() < 0) {
 783        ret = -ECANCELED;
 784        pr_err("ERROR: WC_SIG_IGNORE_BEGIN() failed.\n");
 785        goto out_without_sig_ignored;
 786    }
 787
 788    if (linuxkm_lkcapi_n_registered == 0) {
 789        ret = -ENOENT;
 790        goto out;
 791    }
 792
 793#define UNREGISTER_ALG(alg, alg_class)                                   \
 794    do {                                                                 \
 795        if (alg ## _loaded) {                                            \
 796            if ((alg).base.cra_flags & CRYPTO_ALG_DEAD) {                \
 797                pr_err("alg %s already CRYPTO_ALG_DEAD.\n",              \
 798                       (alg).base.cra_driver_name);                      \
 799                alg ## _loaded = 0;                                      \
 800                ++n_deregistered;                                        \
 801            }                                                            \
 802            else {                                                       \
 803                int cur_refcnt =                                         \
 804                    WC_LKM_REFCOUNT_TO_INT((alg).base.cra_refcnt);       \
 805                if (cur_refcnt == 1) {                                   \
 806                    (crypto_unregister_ ## alg_class)(&(alg));           \
 807                    if (! ((alg).base.cra_flags & CRYPTO_ALG_DEAD)) {    \
 808                        pr_err("ERROR: alg %s not _DEAD after "          \
 809                               "crypto_unregister_%s -- "                \
 810                               "leaving marked as loaded.\n",            \
 811                               (alg).base.cra_driver_name,               \
 812                               #alg_class);                              \
 813                        seen_err = -EBUSY;                               \
 814                    } else {                                             \
 815                        alg ## _loaded = 0;                              \
 816                        ++n_deregistered;                                \
 817                    }                                                    \
 818                }                                                        \
 819                else {                                                   \
 820                    pr_err("alg %s cannot be uninstalled (refcnt = %d)\n", \
 821                           (alg).base.cra_driver_name, cur_refcnt);      \
 822                    if (cur_refcnt > 0) { seen_err = -EBUSY; }           \
 823                }                                                        \
 824            }                                                            \
 825        }                                                                \
 826    } while (0)
 827
 828#ifdef LINUXKM_LKCAPI_REGISTER_AESCBC
 829    UNREGISTER_ALG(cbcAesAlg, skcipher);
 830#endif
 831#ifdef LINUXKM_LKCAPI_REGISTER_AESCFB
 832    UNREGISTER_ALG(cfbAesAlg, skcipher);
 833#endif
 834#ifdef LINUXKM_LKCAPI_REGISTER_AESGCM
 835    UNREGISTER_ALG(gcmAesAead, aead);
 836#endif
 837#ifdef LINUXKM_LKCAPI_REGISTER_AESGCM_RFC4106
 838    UNREGISTER_ALG(gcmAesAead_rfc4106, aead);
 839#endif
 840#ifdef LINUXKM_LKCAPI_REGISTER_AESCCM
 841    UNREGISTER_ALG(ccmAesAead, aead);
 842#endif
 843#ifdef LINUXKM_LKCAPI_REGISTER_AESCCM_RFC4309
 844    UNREGISTER_ALG(ccmAesAead_rfc4309, aead);
 845#endif
 846#ifdef LINUXKM_LKCAPI_REGISTER_AESXTS
 847    UNREGISTER_ALG(xtsAesAlg, skcipher);
 848#endif
 849#ifdef LINUXKM_LKCAPI_REGISTER_AESCTR
 850    UNREGISTER_ALG(ctrAesAlg, skcipher);
 851#endif
 852#ifdef LINUXKM_LKCAPI_REGISTER_AESOFB
 853    UNREGISTER_ALG(ofbAesAlg, skcipher);
 854#endif
 855#ifdef LINUXKM_LKCAPI_REGISTER_AESECB
 856    UNREGISTER_ALG(ecbAesAlg, skcipher);
 857#endif
 858
 859#ifdef LINUXKM_LKCAPI_REGISTER_SHA1
 860    UNREGISTER_ALG(sha1_alg, shash);
 861#endif
 862#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_224
 863    UNREGISTER_ALG(sha2_224_alg, shash);
 864#endif
 865#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_256
 866    UNREGISTER_ALG(sha2_256_alg, shash);
 867#endif
 868#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_384
 869    UNREGISTER_ALG(sha2_384_alg, shash);
 870#endif
 871#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_512
 872    UNREGISTER_ALG(sha2_512_alg, shash);
 873#endif
 874#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_224
 875    UNREGISTER_ALG(sha3_224_alg, shash);
 876#endif
 877#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_256
 878    UNREGISTER_ALG(sha3_256_alg, shash);
 879#endif
 880#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_384
 881    UNREGISTER_ALG(sha3_384_alg, shash);
 882#endif
 883#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_512
 884    UNREGISTER_ALG(sha3_512_alg, shash);
 885#endif
 886
 887#ifdef LINUXKM_LKCAPI_REGISTER_SHA1_HMAC
 888    UNREGISTER_ALG(sha1_hmac_alg, shash);
 889#endif
 890#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_224_HMAC
 891    UNREGISTER_ALG(sha2_224_hmac_alg, shash);
 892#endif
 893#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_256_HMAC
 894    UNREGISTER_ALG(sha2_256_hmac_alg, shash);
 895#endif
 896#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_384_HMAC
 897    UNREGISTER_ALG(sha2_384_hmac_alg, shash);
 898#endif
 899#ifdef LINUXKM_LKCAPI_REGISTER_SHA2_512_HMAC
 900    UNREGISTER_ALG(sha2_512_hmac_alg, shash);
 901#endif
 902#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_224_HMAC
 903    UNREGISTER_ALG(sha3_224_hmac_alg, shash);
 904#endif
 905#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_256_HMAC
 906    UNREGISTER_ALG(sha3_256_hmac_alg, shash);
 907#endif
 908#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_384_HMAC
 909    UNREGISTER_ALG(sha3_384_hmac_alg, shash);
 910#endif
 911#ifdef LINUXKM_LKCAPI_REGISTER_SHA3_512_HMAC
 912    UNREGISTER_ALG(sha3_512_hmac_alg, shash);
 913#endif
 914
 915#ifdef LINUXKM_LKCAPI_REGISTER_HASH_DRBG
 916    /* special deinstallation handler for wc_linuxkm_drbg, to deinstall it as
 917     * the system-wide default rng.
 918     */
 919    if (wc_linuxkm_drbg_loaded) {
 920        ret = wc_linuxkm_drbg_cleanup();
 921        if (ret == 0)
 922            ++n_deregistered;
 923        else
 924            seen_err = ret;
 925    }
 926#endif
 927
 928#ifdef LINUXKM_LKCAPI_REGISTER_ECDSA
 929    #if defined(LINUXKM_ECC192)
 930        UNREGISTER_ALG(ecdsa_nist_p192, akcipher);
 931    #endif /* LINUXKM_ECC192 */
 932    UNREGISTER_ALG(ecdsa_nist_p256, akcipher);
 933    UNREGISTER_ALG(ecdsa_nist_p384, akcipher);
 934    #if defined(HAVE_ECC521)
 935        UNREGISTER_ALG(ecdsa_nist_p521, akcipher);
 936    #endif /* HAVE_ECC521 */
 937#endif /* LINUXKM_LKCAPI_REGISTER_ECDSA */
 938
 939#ifdef LINUXKM_LKCAPI_REGISTER_ECDH
 940    #if defined(LINUXKM_ECC192)
 941        UNREGISTER_ALG(ecdh_nist_p192, kpp);
 942    #endif /* LINUXKM_ECC192 */
 943    UNREGISTER_ALG(ecdh_nist_p256, kpp);
 944    UNREGISTER_ALG(ecdh_nist_p384, kpp);
 945    /* no ecdh p521 in kernel. */
 946#endif /* LINUXKM_LKCAPI_REGISTER_ECDH */
 947
 948#ifdef LINUXKM_LKCAPI_REGISTER_RSA
 949    #if defined(LINUXKM_DIRECT_RSA)
 950        UNREGISTER_ALG(direct_rsa, akcipher);
 951    #endif /* LINUXKM_DIRECT_RSA */
 952
 953    #if !defined(LINUXKM_AKCIPHER_NO_SIGNVERIFY)
 954        #ifdef WOLFSSL_SHA224
 955            UNREGISTER_ALG(pkcs1_sha224, akcipher);
 956        #endif /* WOLFSSL_SHA224 */
 957        #ifndef NO_SHA256
 958            UNREGISTER_ALG(pkcs1_sha256, akcipher);
 959        #endif /* !NO_SHA256 */
 960        #ifdef WOLFSSL_SHA384
 961            UNREGISTER_ALG(pkcs1_sha384, akcipher);
 962        #endif /* WOLFSSL_SHA384 */
 963        #ifdef WOLFSSL_SHA384
 964            UNREGISTER_ALG(pkcs1_sha384, akcipher);
 965        #endif /* WOLFSSL_SHA384 */
 966        #ifdef WOLFSSL_SHA512
 967            UNREGISTER_ALG(pkcs1_sha512, akcipher);
 968        #endif /* WOLFSSL_SHA512 */
 969        #ifdef WOLFSSL_SHA3
 970            UNREGISTER_ALG(pkcs1_sha3_256, akcipher);
 971            UNREGISTER_ALG(pkcs1_sha3_384, akcipher);
 972            UNREGISTER_ALG(pkcs1_sha3_512, akcipher);
 973        #endif /* WOLFSSL_SHA3 */
 974    #else
 975        #ifdef WOLFSSL_SHA224
 976            UNREGISTER_ALG(pkcs1_sha224, sig);
 977        #endif /* WOLFSSL_SHA224 */
 978        #ifndef NO_SHA256
 979            UNREGISTER_ALG(pkcs1_sha256, sig);
 980        #endif /* !NO_SHA256 */
 981        #ifdef WOLFSSL_SHA384
 982            UNREGISTER_ALG(pkcs1_sha384, sig);
 983        #endif /* WOLFSSL_SHA384 */
 984        #ifdef WOLFSSL_SHA384
 985            UNREGISTER_ALG(pkcs1_sha384, sig);
 986        #endif /* WOLFSSL_SHA384 */
 987        #ifdef WOLFSSL_SHA512
 988            UNREGISTER_ALG(pkcs1_sha512, sig);
 989        #endif /* WOLFSSL_SHA512 */
 990        #ifdef WOLFSSL_SHA3
 991            UNREGISTER_ALG(pkcs1_sha3_256, sig);
 992            UNREGISTER_ALG(pkcs1_sha3_384, sig);
 993            UNREGISTER_ALG(pkcs1_sha3_512, sig);
 994        #endif /* WOLFSSL_SHA3 */
 995
 996        UNREGISTER_ALG(pkcs1pad, akcipher);
 997    #endif /* !LINUXKM_AKCIPHER_NO_SIGNVERIFY */
 998#endif /* LINUXKM_LKCAPI_REGISTER_RSA */
 999
1000#ifdef LINUXKM_LKCAPI_REGISTER_DH
1001    #ifdef LINUXKM_DH
1002    UNREGISTER_ALG(dh, kpp);
1003    #endif /* LINUXKM_DH */
1004    #ifdef HAVE_FFDHE_2048
1005    UNREGISTER_ALG(ffdhe2048, kpp);
1006    #endif /* HAVE_FFDHE_2048 */
1007
1008    #ifdef HAVE_FFDHE_3072
1009    UNREGISTER_ALG(ffdhe3072, kpp);
1010    #endif /* HAVE_FFDHE_3072 */
1011
1012    #ifdef HAVE_FFDHE_4096
1013    UNREGISTER_ALG(ffdhe4096, kpp);
1014    #endif /* HAVE_FFDHE_4096 */
1015
1016    #ifdef HAVE_FFDHE_6144
1017    UNREGISTER_ALG(ffdhe6144, kpp);
1018    #endif /* HAVE_FFDHE_6144 */
1019
1020    #ifdef HAVE_FFDHE_8192
1021    UNREGISTER_ALG(ffdhe8192, kpp);
1022    #endif /* HAVE_FFDHE_8192 */
1023#endif /* LINUXKM_LKCAPI_REGISTER_DH */
1024
1025#undef UNREGISTER_ALG
1026
1027    linuxkm_lkcapi_n_registered -= n_deregistered;
1028    pr_info("wolfCrypt: %d algorithm%s deregistered, %d remain%s registered.\n",
1029            n_deregistered, n_deregistered == 1 ? "" : "s",
1030            linuxkm_lkcapi_n_registered, linuxkm_lkcapi_n_registered == 1 ? "s" : "");
1031
1032    if (linuxkm_lkcapi_n_registered > 0) {
1033        ret = -EBUSY;
1034        goto out;
1035    }
1036
1037    linuxkm_lkcapi_registered = 0;
1038
1039    ret = seen_err;
1040
1041out:
1042
1043    (void)WC_SIG_IGNORE_END();
1044
1045out_without_sig_ignored:
1046
1047    WOLFSSL_ATOMIC_STORE(linuxkm_lkcapi_registering_now, 0);
1048
1049    return ret;
1050}
1051
1052#endif /* !WC_SKIP_INCLUDED_C_FILES */